CVE-2023-4727 Information

Description

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID= an attacker can authenticate with an existing session saved in the LDAP directory server which may lead to escalation of privilege.

Reference

https://access.redhat.com/security/cve/CVE-2023-4727 https://bugzilla.redhat.com/show_bug.cgi?id=2232218